Getting Data In

SEDCMD to change field name

saifuddin9122
Path Finder

Hello
i have a log event as
DEBUG 2017.02.06 17:15:35.385: (common.work) Parsed source address, source='10.0.0.2' i want to change the source as src_ip at index time

can any one help me ?

Thanks in advance

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (props.conf on Indexer/heavy forwarder)

[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g

View solution in original post

0 Karma

twinspop
Influencer
SEDCMD-source = s/, source=/, src_ip=/

Although I think a better option is to use a field alias. Settings -> Fields -> Field aliases

somesoni2
Revered Legend

Try like this (props.conf on Indexer/heavy forwarder)

[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!